Editor's note: This article has been corrected. An earlier version of this article incorrectly identified the law firm with which attorney Amy Lenz is affiliated. In fact, Lenz is affiliated with the firm of Baker Hostetler.
A federal judge has ruled indirect employers, such as franchise holders, can also be liable in biometric privacy violation lawsuits, a ruling which could further widen the floodgates of lawsuits swamping businesses in Illinois.
The decision was recently issued by Judge Staci Yandle, of U.S. District Court for the Southern District of Illinois. The decision favored Dylan Rushing in his putative class action against McAlister's Deli, a fast food chain headquartered in Oxford, Mississippi, and against Focus Brands, of Atlanta, Georgia.
Staci M. Yandle
| immigrationcourtside.com
Rushing worked from 2017 to 2019 at the McAlister's Deli location in Edwardsville. McAlister's has outlets in 29 states.
Rushing lodged a suit in March 2022 against McAlister's; its franchisee, Aggressive Developments; and franchise holder, Focus Brands. Rushing dropped Aggressive from the litigation on Feb. 14.
Rushing said he and other employees clocked in and out through a fingerprint scan device. However, McAlister's and Focus allegedly did not obtain employee consent or give them written notices concerning how the scans would be used, as allegedly required by the Illinois Biometric Information Privacy Act (BIPA).
McAlister's and Focus asked Judge Yandle to throw out the case, contending they only indirectly oversaw the biometric scans. They asserted only direct employers, such as the franchisee Aggressive Developments, should be held liable for improperly collecting data under the BIPA law.
Yandle, who was nominated to the bench in 2014 by President Barack Obama, refused to toss the case.
In a short three-page order, Yandle said she saw in the BIPA statute no language limiting liability only to immediate, direct employers. She said prior decisions of other courts make clear, in her opinion, that "any entity that collects such biometric information may incur liability." In this case, Yandle said that means BIPA liability could extend to franchisors, like McAlister's and Focus.
Rushing has been represented by attorney Timothy P. Kingsbury, of McGuire Law, of Chicago.
McAlister's and Focus have been defended by attorney Amy L. Lenz, of Baker Hostetler, of Chicago.
Yandle's finding is one more blow to businesses, big and small, reeling under the onslaught of thousands of BIPA suits statewide. And many more are expected, following recent rulings by the Illinois Supreme Court, which appear to clear the path to possible super massive jury verdicts that could easily soar into the hundreds of millions or even billions of dollars for even moderately sized employers.
On Feb. 17, the Illinois Supreme Court ruled 4-3 that BIPA allows for damages of $1,000 to $5,000 each time a scan is taken in violation of BIPA, not just for the first violation. The ruling was made in a class action suit against the White Castle hamburger chain, potentially involving 9,500 current and former workers. If only the first violation is counted, the payout could be $9.5 million; if every violation is tallied, the figure could become $17 billion.
Illinois Supreme Court Justice Elizabeth Rochford, who penned the majority ruling, admitted the ruling could destroy businesses, but said high damage amounts should spur employers to comply with BIPA. She added that businesses can try to urge legislators to soften BIPA. However, the General Assembly is Democrat-controlled and trial lawyers, by and large, such as those who stand to gain many millions of dollars in fees from BIPA-related cases, donate generously to state Democrats.
The other recourse suggested by Rochford, is for employers to hope judges, out of fairness, will ensure damage amounts are not catastrophic.
A dissenting justice, David Overstreet, complained the ruling will lead to "absurd" results. One of these results is plaintiffs will now be motivated to wait as long as possible, within the five-year accrual period set out by law, so as to collect as many violations and maximize their payout in court.
Since 2015, the BIPA statute has been used to bring claims against giant tech companies like Facebook and Google, resulting in settlements of $650 million and $100 million, respectively. However, to date, most of the actions have targeted smaller companies.
Big or small, the companies are often sued for not gaining written consent from workers before having them furnish biometric identifiers to check in and out of work, or to access secure facilities or systems on the job. Many suits are also based on employers failing to tell workers beforehand how biometric data will be used.
Many companies facing BIPA class actions have opted to settle the actions, with hundreds of settlements paying as much as $50 million each. Lawyers representing plaintiffs have typically claimed 25 to 40 percent of those payouts as their fees.